CVE-2007-0681:Security bypass vulnerability in ExtCalendar 2 and earlier that allows remote attackers to change arbitrary users' passwords without the original password by tampering with values sent to register.php.

splash
Back

Description Preview

ExtCalendar’s profile.php in version 2 and earlier contains a vulnerability that lets remote attackers modify the passwords of arbitrary users without knowing their current passwords, by sending manipulated data to register.php. This may also enable other unauthorized actions depending on how register.php handles such input. The issue stems from insufficient server-side validation and trusting client-provided values in the password-change workflow, potentially leading to account compromise or escalation.

Overview

ExtCalendar 2 and earlier versions expose a password-change vulnerability via profile.php that permits attackers to alter other users’ passwords without providing the existing password, by tampering with registration input. This security bypass highlights weak server-side validation and insufficient authorization controls in the password management path, enabling unauthorized access and potential broader misuse.

Remediation

  • Upgrade to a fixed version: Move to a newer ExtCalendar release (or apply vendor-provided patches) where the vulnerability is resolved.
  • If upgrading is not possible:
    • Enforce strict password-change validation: require the current password and proper authentication before allowing any password modification.
    • Ensure server-side authorization checks: only the target user or an authorized administrator should be able to change a password.
    • Do not trust client-side inputs for privileged actions: validate and sanitize all inputs on the server; avoid using register.php as a password-change endpoint without robust checks.
    • Implement CSRF protection on password-change/change-password endpoints to prevent cross-site request forgery.
    • Consider removing or hardening the register.php flow for password changes; implement a dedicated, access-controlled password update function.
    • Review and tighten access controls around profile.php and related endpoints; log all password-change attempts.
    • If a breach is suspected, invalidate sessions and require users to reset passwords after patching.
  • General: Ensure communications are over HTTPS, review authentication/session management, and monitor for anomalous password-change activity.

References

Industry ExposureMost to least
This section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.

  1. Accommodation & Food Services: Low
    Accommodation & Food Services
  2. Administrative, Support, Waste Management & Remediation Services: Low
    Administrative, Support, Waste Management & Remediation Services
  3. Agriculture, Forestry Fishing & Hunting: Low
    Agriculture, Forestry Fishing & Hunting
  4. Arts, Entertainment & Recreation: Low
    Arts, Entertainment & Recreation
  5. Construction: Low
    Construction
  6. Educational Services: Low
    Educational Services
  7. Finance and Insurance: Low
    Finance and Insurance
  8. Health Care & Social Assistance: Low
    Health Care & Social Assistance
  9. Information: Low
    Information
  10. Management of Companies & Enterprises: Low
    Management of Companies & Enterprises
  11. Manufacturing: Low
    Manufacturing
  12. Mining: Low
    Mining
  13. Other Services (except Public Administration): Low
    Other Services (except Public Administration)
  14. Professional, Scientific, & Technical Services: Low
    Professional, Scientific, & Technical Services
  15. Public Administration: Low
    Public Administration
  16. Real Estate Rental & Leasing: Low
    Real Estate Rental & Leasing
  17. Retail Trade: Low
    Retail Trade
  18. Transportation & Warehousing: Low
    Transportation & Warehousing
  19. Utilities: Low
    Utilities
  20. Wholesale Trade: Low
    Wholesale Trade

Focus on What Matters

  1. See Everything.
  2. Identify True Risk.
  3. Proactively Mitigate Threats.

Let's talk!

background